Extracted

Extracted

• • Target
    473b20454e5d696d377335377189027f.exe
  • Size 247KB
  • SHA256 f2eec5ba2e7c48a086cac282dee807985a59d77c3a4fc4801466b0bae09bc45b
  • MD5 473b20454e5d696d377335377189027f
  • SHA1 8e959953d5a9c683608ae1d8bea83e230f6ea60a
  • SHA512 e2f4d22e72abc27d5539abda482cdbac45f697f8ae3b9d1d913ff0206cf5801a8d806de77db94a25ac922d0976a9b5f29e784cbc303c6c729323970b6cdf1640
  • SSDEEP 6144:SDVU7z6DCGbAR/VeDC1tAO1cCh0NwC9urBiIg:Sy7zaC+UjI3NwcurBiIg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyredlinesmokeloaderbackdoordiscoveryinfostealerspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2